TCP 9050
Synopsis
- TCP port 9050 is most commonly used by Tor as its SOCKS5 proxy port.
- The Tor daemon (tor) on Linux/BSD/Windows typically listens on 127.0.0.1:9050 for applications to route traffic through the Tor network.
- Orbot (Android) provides a local SOCKS proxy on 9050 to tunnel app traffic via Tor.
- OpenWrt and similar router distributions often configure the tor package with SocksPort 9050.
- HTTP proxies like Privoxy or the (now deprecated) Polipo are frequently set to forward traffic to 127.0.0.1:9050 when chained with Tor.
- For reference, Tor’s control port is usually 9051; 9050 is the SOCKS port.
- Associated with hacking/exploitation: some malware bundles Tor and opens a local or misconfigured public 9050 proxy to hide command-and-control traffic or enable proxy abuse.
Observed activity
Last 30 days
Detailed chart